@ai-ecoverse/slicc-kernel 1.81.0 → 1.83.0

package/dist/kernel-worker.js

@@ -131,8 +131,8 @@ function descendants(path) {
   return IDBKeyRange.bound(`${path}/`, `${path}0`, false, true);
 }
 function settle(transaction, value) {
-  return new Promise((resolve, reject) => {
-    transaction.oncomplete = () => resolve(value());
+  return new Promise((resolve2, reject) => {
+    transaction.oncomplete = () => resolve2(value());
     transaction.onabort = () => reject(transaction.error ?? new Error("metadata transaction aborted"));
   });
 }
@@ -249,14 +249,14 @@ var IndexedDbMeta = class {
   }
 };
 function openMeta(name2, factory) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const request2 = factory.open(name2, META_VERSION);
     request2.onupgradeneeded = (event) => {
       if (event.oldVersion < 1) {
         request2.result.createObjectStore(META_STORE, { keyPath: "path" }).createIndex("dir", "dir");
       }
     };
-    request2.onsuccess = () => resolve(new IndexedDbMeta(request2.result));
+    request2.onsuccess = () => resolve2(new IndexedDbMeta(request2.result));
     request2.onerror = () => reject(request2.error);
   });
 }
@@ -360,10 +360,106 @@ async function chownAs(fs, cred, path, change) {
   });
 }
 
+// src/fs/integrity.ts
+var KERNEL_CALLER = { pid: 0, uid: 0 };
+function integrityOptions(options) {
+  if (options && typeof options.lookup !== "function") {
+    throw new TypeError("protect.integrity.lookup must be a function");
+  }
+  integrityUnknown(options);
+}
+function integrityUnknown(options) {
+  const unknown = options?.unknown ?? "allow";
+  if (unknown !== "allow" && unknown !== "deny") {
+    throw new TypeError("protect.integrity.unknown must be 'allow' or 'deny'");
+  }
+  return unknown;
+}
+function hex(digest) {
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256(bytes) {
+  return hex(await crypto.subtle.digest("SHA-256", bytes));
+}
+var Integrity = class {
+  prefixes;
+  root;
+  lookup;
+  unknown;
+  report;
+  unverified = /* @__PURE__ */ new Set();
+  constructor(prefixes2, root, options, report) {
+    this.prefixes = prefixes2;
+    this.root = root;
+    this.lookup = options.lookup;
+    this.unknown = integrityUnknown(options);
+    this.report = report;
+  }
+  async real(path) {
+    const at = normalizePath(path);
+    const real = await this.root.realpath?.(at, true).catch(() => void 0) ?? at;
+    return isProtected(this.prefixes, real) ? real : void 0;
+  }
+  async key(path) {
+    const real = await this.real(path);
+    if (real === void 0 || !this.root.version) return void 0;
+    return `${real}\0${await this.root.version(real)}`;
+  }
+  async read(path, caller, plain) {
+    return (await this.readKeyed(path, caller, plain)).bytes;
+  }
+  async readKeyed(path, caller, plain) {
+    const real = await this.real(path);
+    if (real === void 0) return { bytes: await plain() };
+    const read = this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const { bytes } = read;
+    const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
+    const actual = await sha256(bytes);
+    const denial = { pid: caller.pid, uid: caller.uid, path: real, actual };
+    const tagged = caller.tag !== void 0 ? { tag: caller.tag } : {};
+    let expected;
+    try {
+      expected = await this.expected(real);
+    } catch {
+      this.say({ ...denial, ...tagged, op: "exec-integrity", errno: "EACCES" });
+      throw fsError("EACCES", `integrity lookup failed: ${real}`);
+    }
+    if (expected === void 0) {
+      if (this.unknown === "allow") {
+        if (!this.unverified.has(real)) {
+          this.unverified.add(real);
+          this.say({ ...denial, ...tagged, op: "exec-unverified", errno: "ENODATA" });
+        }
+        return keyed;
+      }
+    } else if (expected === actual) {
+      return keyed;
+    }
+    const known = expected !== void 0 ? { expected } : {};
+    this.say({ ...denial, ...tagged, ...known, op: "exec-integrity", errno: "EACCES" });
+    throw fsError("EACCES", `integrity check failed: ${real}`);
+  }
+  async expected(path) {
+    const answer = await this.lookup(path);
+    return typeof answer === "string" ? answer.toLowerCase() : void 0;
+  }
+  say(event) {
+    try {
+      this.report(event);
+    } catch {
+    }
+  }
+};
+
 // src/fs/protect.ts
 function protectInit(protection) {
   const writers = [...writerTags(protection)];
-  return { paths: [...protection.paths], ...writers.length > 0 ? { writers } : {} };
+  const { integrity } = protection;
+  return {
+    paths: [...protection.paths],
+    ...writers.length > 0 ? { writers } : {},
+    ...integrity ? { integrity: { unknown: integrityUnknown(integrity) } } : {}
+  };
 }
 function writerTags(protection) {
   const writers = protection?.writers ?? [];
@@ -644,11 +740,11 @@ var RemoteWatch = class {
     const seq2 = ++this.seq;
     this.channel.postMessage({ tab: this.tab, paths: this.mine, seq: seq2 });
     if (this.peers.size === 0) return Promise.resolve();
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const done4 = () => {
         clearTimeout(timer);
         this.waiting.delete(seq2);
-        resolve();
+        resolve2();
       };
       const timer = setTimeout(() => {
         done4();
@@ -744,7 +840,7 @@ async function openSync(handle) {
       const delay = SYNC_BACKOFF_MS[attempt];
       if (!LOCKED.has(err?.name)) throw err;
       if (delay === void 0) return void 0;
-      await new Promise((resolve) => setTimeout(resolve, delay));
+      await new Promise((resolve2) => setTimeout(resolve2, delay));
     }
   }
 }
@@ -1201,7 +1297,7 @@ var OpfsFs = class {
         const again = name2 === "NotReadableError" || locks && LOCKED.has(name2);
         if (!again || attempt >= READ_ATTEMPTS)
           throw translate(err, path, locks ? "write" : "read");
-        await new Promise((resolve) => setTimeout(resolve, attempt * 10));
+        await new Promise((resolve2) => setTimeout(resolve2, attempt * 10));
       }
     }
   }
@@ -1220,6 +1316,29 @@ var OpfsFs = class {
       false
     );
   }
+  async readVersioned(path) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => {
+        const file = await handle.getFile();
+        const bytes = new Uint8Array(await file.arrayBuffer());
+        return { bytes, version: `${file.lastModified}:${file.size}` };
+      },
+      false
+    );
+  }
+  async version(path) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => {
+        const file = await handle.getFile();
+        return `${file.lastModified}:${file.size}`;
+      },
+      false
+    );
+  }
   async pread(path, offset, length2) {
     const handle = await this.existing(path);
     return this.retrying(
@@ -1235,8 +1354,8 @@ var OpfsFs = class {
   }
   async truncate(path, size) {
     const handle = await this.existing(path, true);
-    const resolve = this.ranged || this.remote?.watched();
-    const target = resolve ? (await this.locate(path, true)).path : path;
+    const resolve2 = this.ranged || this.remote?.watched();
+    const target = resolve2 ? (await this.locate(path, true)).path : path;
     await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
     this.written(target);
   }
@@ -1660,8 +1779,8 @@ function memoryMedia() {
   };
 }
 function settle2(request2, value) {
-  return new Promise((resolve, reject) => {
-    request2.onsuccess = () => resolve(value());
+  return new Promise((resolve2, reject) => {
+    request2.onsuccess = () => resolve2(value());
     request2.onerror = () => reject(request2.error);
   });
 }
@@ -1699,7 +1818,7 @@ function pinScript(url) {
 
 // src/cdp/port.ts
 function portCdpHook(ask, gone) {
-  return (request2) => new Promise((resolve, reject) => {
+  return (request2) => new Promise((resolve2, reject) => {
     const { port1, port2 } = new MessageChannel();
     let closed = false;
     const conn = {
@@ -1717,7 +1836,7 @@ function portCdpHook(ask, gone) {
     };
     port1.addEventListener("message", ({ data }) => {
       if ("m" in data) conn.onmessage?.(data.m);
-      else if ("open" in data) resolve(conn);
+      else if ("open" in data) resolve2(conn);
       else if ("error" in data) {
         closed = true;
         port1.close();
@@ -2251,9 +2370,9 @@ var KernelPipe = class {
     let filled = 0;
     for (const chunk2 of this.chunks) {
       if (filled === out.length) break;
-      const count = Math.min(chunk2.length, out.length - filled);
-      out.set(chunk2.subarray(0, count), filled);
-      filled += count;
+      const count2 = Math.min(chunk2.length, out.length - filled);
+      out.set(chunk2.subarray(0, count2), filled);
+      filled += count2;
     }
     return out;
   }
@@ -2284,25 +2403,25 @@ var KernelPipe = class {
     let filled = 0;
     while (filled < n) {
       const head = this.chunks[0];
-      const count = Math.min(head.length, n - filled);
-      out.set(head.subarray(0, count), filled);
-      filled += count;
-      if (count === head.length) this.chunks.shift();
-      else this.chunks[0] = head.subarray(count);
+      const count2 = Math.min(head.length, n - filled);
+      out.set(head.subarray(0, count2), filled);
+      filled += count2;
+      if (count2 === head.length) this.chunks.shift();
+      else this.chunks[0] = head.subarray(count2);
     }
     this.size -= n;
     return out;
   }
   changed(signal) {
     if (signal?.aborted) return Promise.reject(new PipeError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new PipeError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -2311,7 +2430,7 @@ var KernelPipe = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 
@@ -2772,14 +2891,14 @@ var Changes = class {
   waiters = [];
   wait(signal) {
     if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new KernelError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -2788,7 +2907,7 @@ var Changes = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 function link(a, b) {
@@ -2956,7 +3075,7 @@ var KernelSocket = class _KernelSocket {
     });
     const { host, port } = addr;
     const dialled = new Promise(
-      (resolve) => resolve(route.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
+      (resolve2) => resolve2(route.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
     );
     dialled.then(
       (conn) => abort.signal.aborted && conn.close(),
@@ -3306,8 +3425,8 @@ var MessageQueue = class {
     this.overflow = overflow;
     this.limit = limit;
     this.taken = taken;
-    this.closed = new Promise((resolve) => {
-      this.settle = resolve;
+    this.closed = new Promise((resolve2) => {
+      this.settle = resolve2;
     });
   }
   push(message3) {
@@ -3346,8 +3465,8 @@ var MessageQueue = class {
         continue;
       }
       if (this.ended) return;
-      await new Promise((resolve) => {
-        this.waiter = resolve;
+      await new Promise((resolve2) => {
+        this.waiter = resolve2;
       });
     }
   }
@@ -3438,8 +3557,8 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const relay = async (nid, socket) => {
     let ending;
     let late;
-    const unanswered = new Promise((resolve) => {
-      late = () => resolve("late");
+    const unanswered = new Promise((resolve2) => {
+      late = () => resolve2("late");
     });
     const flow = {
       inflight: 0,
@@ -3467,8 +3586,8 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
         }
         flow.inflight += payloadSize(data);
         while (flow.inflight > INBOUND_LIMIT && !flow.closing) {
-          await new Promise((resolve) => {
-            flow.wake = resolve;
+          await new Promise((resolve2) => {
+            flow.wake = resolve2;
           });
         }
       }
@@ -3487,7 +3606,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
     if (!socket) return;
     socket.send(call.data);
     while (socket.buffered > SEND_BUFFER && sockets.has(call.nid)) {
-      await new Promise((resolve) => setTimeout(resolve, 10));
+      await new Promise((resolve2) => setTimeout(resolve2, 10));
     }
     peer.postMessage({ net: "ws-acked", nid: call.nid, n: payloadSize(call.data) });
   };
@@ -4467,6 +4586,27 @@ function clipboardAsker(port) {
   return { hook, answer };
 }
 
+// src/integrity-relay.ts
+function integrityAsker(port) {
+  const asks = /* @__PURE__ */ new Map();
+  let next2 = 0;
+  const lookup = (path) => {
+    const id2 = ++next2;
+    const waiting = Promise.withResolvers();
+    asks.set(id2, waiting);
+    port.postMessage({ integrityAsk: { id: id2, path } });
+    return waiting.promise;
+  };
+  const answer = ({ id: id2, hash, error }) => {
+    const waiting = asks.get(id2);
+    if (!waiting) return;
+    asks.delete(id2);
+    if (error !== void 0) waiting.reject(new Error(error));
+    else waiting.resolve(hash);
+  };
+  return { lookup, answer };
+}
+
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
 var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
@@ -4973,10 +5113,10 @@ var Budget = class {
   async acquire(n, signal) {
     while (this.free < n) {
       signal.throwIfAborted();
-      await new Promise((resolve) => {
+      await new Promise((resolve2) => {
         const done4 = () => {
           signal.removeEventListener("abort", done4);
-          resolve();
+          resolve2();
         };
         this.waiters.push(done4);
         signal.addEventListener("abort", done4, { once: true });
@@ -5118,14 +5258,14 @@ async function watchHangup(conn, abort, until) {
   }
 }
 function untilAborted(response, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const onAbort = () => {
       reject(signal.reason ?? new KernelError("EINTR"));
       response.then((late) => late.cancel()).catch(() => void 0);
     };
     if (signal.aborted) return onAbort();
     signal.addEventListener("abort", onAbort, { once: true });
-    response.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    response.then(resolve2, reject).finally(() => signal.removeEventListener("abort", onAbort));
   });
 }
 function plainResponse(status, message3) {
@@ -5158,8 +5298,8 @@ function wireCode(code) {
   return sendableCode(code) ? code : 1011;
 }
 function quietly(ms) {
-  return new Promise((resolve) => {
-    AbortSignal.timeout(ms).addEventListener("abort", () => resolve(), { once: true });
+  return new Promise((resolve2) => {
+    AbortSignal.timeout(ms).addEventListener("abort", () => resolve2(), { once: true });
   });
 }
 var RealmProxy = class {
@@ -5257,7 +5397,7 @@ var RealmProxy = class {
       return false;
     }
     const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
-    const keep = keepsAlive(req);
+    const keep2 = keepsAlive(req);
     const framing = requestFraming(req.headers);
     const reserve = framing.kind === "length" ? framing.length : framing.kind === "chunked" ? this.cap() : 0;
     if (reserve > this.cap()) throw new HttpError(413, `request body over ${this.cap()} bytes`);
@@ -5280,7 +5420,7 @@ var RealmProxy = class {
       } finally {
         this.bodies.release(reserve);
       }
-      return await this.relay(conn, req.method, req.minor, response, keep);
+      return await this.relay(conn, req.method, req.minor, response, keep2);
     } finally {
       this.stop.signal.removeEventListener("abort", stopExchange);
       abort.abort();
@@ -5328,8 +5468,8 @@ var RealmProxy = class {
       bodiless: bodiless2
     });
     const chunked = !bodiless2 && minor >= 1;
-    const keep = keepAlive && (bodiless2 || chunked);
-    headers.push(["Connection", keep ? "keep-alive" : "close"]);
+    const keep2 = keepAlive && (bodiless2 || chunked);
+    headers.push(["Connection", keep2 ? "keep-alive" : "close"]);
     if (chunked) headers.push(["Transfer-Encoding", "chunked"]);
     const signal = this.stop.signal;
     await conn.write(
@@ -5338,7 +5478,7 @@ var RealmProxy = class {
     );
     if (bodiless2) {
       await response.cancel();
-      return keep;
+      return keep2;
     }
     try {
       for await (const piece of response.body) {
@@ -5349,7 +5489,7 @@ var RealmProxy = class {
       return false;
     }
     if (chunked) await conn.write(LAST_CHUNK, signal);
-    return keep;
+    return keep2;
   }
   async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
@@ -5572,10 +5712,10 @@ function header(der, at) {
   let len = der[at + 1];
   let start2 = at + 2;
   if (len & 128) {
-    const count = len & 127;
+    const count2 = len & 127;
     len = 0;
-    for (let i = 0; i < count; i++) len = len * 256 + der[start2 + i];
-    start2 += count;
+    for (let i = 0; i < count2; i++) len = len * 256 + der[start2 + i];
+    start2 += count2;
   }
   if (start2 + len > der.length) throw new Error("truncated DER");
   return [tag, start2, start2 + len];
@@ -5693,18 +5833,18 @@ var LEAF_LIFETIME = 7 * DAY;
 var ECDSA = { name: "ECDSA", namedCurve: "P-256" };
 var SIGN = { name: "ECDSA", hash: "SHA-256" };
 function request(req) {
-  return new Promise((resolve, reject) => {
-    req.onsuccess = () => resolve(req.result);
+  return new Promise((resolve2, reject) => {
+    req.onsuccess = () => resolve2(req.result);
     req.onerror = () => reject(req.error);
   });
 }
 function indexedDbCaStore(dbName = "slicc-realm-ca") {
   let db;
   const open = () => {
-    db ??= new Promise((resolve, reject) => {
+    db ??= new Promise((resolve2, reject) => {
       const req = indexedDB.open(dbName, 1);
       req.onupgradeneeded = () => req.result.createObjectStore("ca");
-      req.onsuccess = () => resolve(req.result);
+      req.onsuccess = () => resolve2(req.result);
       req.onerror = () => reject(req.error);
     });
     db.catch(() => {
@@ -5728,8 +5868,8 @@ function indexedDbCaStore(dbName = "slicc-realm-ca") {
         if (kept === record) store.put(record, owner);
         else stored = kept;
       };
-      await new Promise((resolve, reject) => {
-        tx.oncomplete = () => resolve();
+      await new Promise((resolve2, reject) => {
+        tx.oncomplete = () => resolve2();
         tx.onerror = () => reject(tx.error);
       });
       return stored;
@@ -6258,8 +6398,8 @@ var RemoteTransport = class {
   }
   ask(call) {
     if (this.failure) return Promise.reject(this.failure);
-    return new Promise((resolve, reject) => {
-      this.waiting.set(call.nid, { resolve, reject });
+    return new Promise((resolve2, reject) => {
+      this.waiting.set(call.nid, { resolve: resolve2, reject });
       this.port.postMessage(call);
     });
   }
@@ -6664,7 +6804,7 @@ var CdpFacade = class {
     const conn = await this.host(runtime);
     try {
       const reply = await new Promise(
-        (resolve, reject) => {
+        (resolve2, reject) => {
           const timer = setTimeout(
             () => reject(new HttpError(504, "the CDP host did not answer Target.getTargets")),
             this.options.listTimeout ?? LIST_TIMEOUT
@@ -6677,7 +6817,7 @@ var CdpFacade = class {
             const parsed2 = JSON.parse(message3);
             if (parsed2.id !== 1) return;
             clearTimeout(timer);
-            resolve(parsed2);
+            resolve2(parsed2);
           };
           conn.send(JSON.stringify({ id: 1, method: "Target.getTargets" }));
         }
@@ -6737,9 +6877,9 @@ var Relay = class {
   }
   async start(head) {
     await this.send(head);
-    const hostGone = new Promise((resolve) => {
+    const hostGone = new Promise((resolve2) => {
       this.host.onclose = (reason) => {
-        void this.end(reason ? CLOSE.error : CLOSE.normal, reason ?? "").then(() => resolve());
+        void this.end(reason ? CLOSE.error : CLOSE.normal, reason ?? "").then(() => resolve2());
       };
     });
     this.host.onmessage = (message3) => {
@@ -6753,8 +6893,8 @@ var Relay = class {
     await Promise.race([pumping, hostGone]);
     await this.writes;
     let timer;
-    const waited = new Promise((resolve) => {
-      timer = setTimeout(resolve, this.closeWaitMs);
+    const waited = new Promise((resolve2) => {
+      timer = setTimeout(resolve2, this.closeWaitMs);
     });
     await Promise.race([pumping, waited]);
     clearTimeout(timer);
@@ -7093,7 +7233,7 @@ function owned(path, st) {
 function unchanged(a, b, bytes) {
   return a.ino === b.ino && a.mtime.getTime() === b.mtime.getTime() && a.size === b.size && bytes.length === b.size;
 }
-async function sha256(bytes) {
+async function sha2562(bytes) {
   const digest = new Uint8Array(
     await crypto.subtle.digest("SHA-256", bytes)
   );
@@ -7149,7 +7289,7 @@ async function attest(fs, asked, o) {
     const bytes = (await fs.readFileBuffer(path)).slice();
     const after = await fs.lstat(path);
     if (unchanged(before, after, bytes)) {
-      return attested(path, after, bytes, await sha256(bytes), o, parents);
+      return attested(path, after, bytes, await sha2562(bytes), o, parents);
     }
     if (tries >= 1) refuse("EAGAIN", path, "changed while it was read");
   }
@@ -7404,16 +7544,16 @@ var FreshModules = class {
         if (head) await decide(path, head);
       };
     }
-    const bound = /* @__PURE__ */ new WeakMap();
+    const bound2 = /* @__PURE__ */ new WeakMap();
     return new Proxy(fs, {
       get(target, key, receiver) {
         if (Object.hasOwn(overrides, key)) return overrides[key];
         const value = Reflect.get(target, key, receiver);
         if (typeof value !== "function") return value;
-        let method = bound.get(value);
+        let method = bound2.get(value);
         if (method === void 0) {
           method = value.bind(target);
-          bound.set(value, method);
+          bound2.set(value, method);
         }
         return method;
       }
@@ -7481,12 +7621,12 @@ var PathGate = class {
   tails = /* @__PURE__ */ new Map();
   async acquire(path) {
     const prev = this.tails.get(path) ?? Promise.resolve();
-    const { promise, resolve } = Promise.withResolvers();
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
     const tail = prev.then(() => promise);
     this.tails.set(path, tail);
     await prev;
     return () => {
-      resolve();
+      resolve2();
       if (this.tails.get(path) === tail) this.tails.delete(path);
     };
   }
@@ -7964,7 +8104,7 @@ var ChildTable = class {
   }
   async nextChange(candidates, flags2, interrupt) {
     let wake;
-    const stateChange = new Promise((resolve) => wake = resolve);
+    const stateChange = new Promise((resolve2) => wake = resolve2);
     const watching = flags2.untraced || flags2.continued;
     if (watching && wake) this.stateChanged.push(wake);
     try {
@@ -8011,6 +8151,65 @@ var ChildTable = class {
   }
 };
 
+// src/kernel/exec-ticket.ts
+var TICKET_ENV = "SLICC_SEALED_TICKET";
+var TICKET_TTL_MS = 3e4;
+var MAX_TICKETS = 256;
+var TICKET = /^[0-9a-f]{32}$/;
+async function argvDigest(argv) {
+  const bytes = new TextEncoder().encode(JSON.stringify(argv));
+  const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+  return [...hash].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function isStrings(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function stringRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const entries = Object.entries(value);
+  return entries.every(([, v]) => typeof v === "string") ? Object.fromEntries(entries) : void 0;
+}
+var TicketBook = class {
+  booked = /* @__PURE__ */ new Map();
+  now;
+  normalise = async (path) => path;
+  constructor(now = Date.now) {
+    this.now = now;
+  }
+  get size() {
+    return this.booked.size;
+  }
+  async record(req, reply, pid) {
+    const { ticket, error } = reply;
+    if (error !== void 0 || typeof ticket !== "string" || !TICKET.test(ticket)) return;
+    const { path, argv, cwd } = req;
+    const entry = {
+      pid,
+      path: await this.normalise(path),
+      requested: path,
+      requestedCwd: cwd,
+      argv: await argvDigest(argv),
+      cwd: await this.normalise(cwd),
+      at: this.now()
+    };
+    this.prune();
+    while (this.booked.size >= MAX_TICKETS)
+      this.booked.delete(this.booked.keys().next().value);
+    this.booked.set(ticket, entry);
+  }
+  take(ticket) {
+    const booked = this.booked.get(ticket);
+    this.booked.delete(ticket);
+    return booked && this.now() - booked.at < TICKET_TTL_MS ? booked : void 0;
+  }
+  prune() {
+    const now = this.now();
+    for (const [ticket, booked] of this.booked) {
+      if (now - booked.at >= TICKET_TTL_MS) this.booked.delete(ticket);
+    }
+  }
+};
+
 // src/mount/protocol.ts
 var DRIVER_PROTOCOL = [1, 2];
 function driverVersionError(theirs) {
@@ -8081,7 +8280,7 @@ var DriverConnection = class _DriverConnection {
   call(call, transfer = []) {
     if (this.failure) return Promise.reject(this.failure);
     const id2 = ++this.nextId;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = unref(
         setTimeout(() => {
           this.waiting.delete(id2);
@@ -8094,7 +8293,7 @@ var DriverConnection = class _DriverConnection {
           this.onFail?.(error);
         }, this.timeoutMs)
       );
-      this.waiting.set(id2, { resolve, reject, timer });
+      this.waiting.set(id2, { resolve: resolve2, reject, timer });
       this.port.postMessage({ ...call, id: id2 }, transfer);
     });
   }
@@ -8237,8 +8436,8 @@ var HeldPaths = class extends Map {
       this.keptHandles.delete(handle);
       if (kept) this.letGo(kept);
     }
-    const count = (this.opens.get(key) ?? 0) + (on ? 1 : -1);
-    if (count > 0) this.opens.set(key, count);
+    const count2 = (this.opens.get(key) ?? 0) + (on ? 1 : -1);
+    if (count2 > 0) this.opens.set(key, count2);
     else {
       this.opens.delete(key);
       for (const id2 of this.handlesAt(key)) this.handles.delete(id2);
@@ -8252,8 +8451,8 @@ var HeldPaths = class extends Map {
     return this.lastHandle;
   }
   holdWrite(path, on) {
-    const count = (this.get(path) ?? 0) + (on ? 1 : -1);
-    if (count > 0) this.set(path, count);
+    const count2 = (this.get(path) ?? 0) + (on ? 1 : -1);
+    if (count2 > 0) this.set(path, count2);
     else {
       this.delete(path);
       this.revoked.delete(path);
@@ -8275,18 +8474,18 @@ var HeldPaths = class extends Map {
     for (const path of this.keys()) if (within5(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
-    for (const [path, count] of [...this]) {
+    for (const [path, count2] of [...this]) {
       if (!within5(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
-      this.set(moved2, (this.get(moved2) ?? 0) + count);
+      this.set(moved2, (this.get(moved2) ?? 0) + count2);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
-    for (const [path, count] of [...this.opens]) {
+    for (const [path, count2] of [...this.opens]) {
       if (!within5(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.opens.delete(path);
-      this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count);
+      this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count2);
     }
     for (const [id2, key] of this.handles) {
       if (within5(key, from)) this.handles.set(id2, to + key.slice(from.length));
@@ -10580,7 +10779,7 @@ var AsyncOps = class {
     this.wake();
   }
   sleep(timeoutMs, signal) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let timer;
       const cleanup = () => {
         clearTimeout(timer);
@@ -10589,7 +10788,7 @@ var AsyncOps = class {
       };
       const wake = () => {
         cleanup();
-        resolve(true);
+        resolve2(true);
       };
       const abort = () => {
         cleanup();
@@ -10600,7 +10799,7 @@ var AsyncOps = class {
       if (timeoutMs !== void 0) {
         timer = setTimeout(() => {
           cleanup();
-          resolve(false);
+          resolve2(false);
         }, timeoutMs);
       }
     });
@@ -11022,7 +11221,7 @@ var Resolver = class {
 };
 function waitFor(lookup, signal) {
   lookup.waiters++;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const abort = () => {
       if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
       reject(new KernelError("EINTR"));
@@ -11032,7 +11231,7 @@ function waitFor(lookup, signal) {
       if (signal?.aborted) return;
       lookup.waiters--;
       signal?.removeEventListener("abort", abort);
-      resolve(value);
+      resolve2(value);
     });
   });
 }
@@ -11213,8 +11412,8 @@ var KernelTty = class {
   }
   rubOut(n) {
     const dropped2 = this.line.splice(this.line.length - n, n);
-    const utf82 = (this.termios.c_iflag & IUTF8) !== 0;
-    const cells = utf82 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
+    const utf83 = (this.termios.c_iflag & IUTF8) !== 0;
+    const cells = utf83 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
     if (cells > 0 && this.termios.c_lflag & ECHO) {
       this.output(encoder3.encode("\b \b".repeat(cells)), false);
     }
@@ -11284,14 +11483,14 @@ var KernelTty = class {
   }
   changed(signal) {
     if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new KernelError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -11300,7 +11499,7 @@ var KernelTty = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 
@@ -11399,14 +11598,14 @@ var PtyPair = class {
   }
   changed(signal) {
     if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onAbort = () => {
         this.waiters = this.waiters.filter((w) => w !== waiter);
         reject(new KernelError("EINTR"));
       };
       const waiter = () => {
         signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       };
       this.waiters.push(waiter);
       signal?.addEventListener("abort", onAbort, { once: true });
@@ -11415,7 +11614,7 @@ var PtyPair = class {
   wake() {
     const waiters = this.waiters;
     this.waiters = [];
-    for (const resolve of waiters) resolve();
+    for (const resolve2 of waiters) resolve2();
   }
 };
 var PtyTable = class {
@@ -11480,7 +11679,8 @@ function ptySyscall(req, ctx) {
       if (!ctx.ptys) throw new KernelError("ENOENT");
       const pair = ctx.ptys.get(req.n);
       ttyOpenable(ctx.guard, pair.slave);
-      const fd = ctx.fds.install(pair.openSlave(), 3);
+      const slave = pair.openSlave();
+      const fd = ctx.fds.install(ctx.ttyFilter?.(slave) ?? slave, 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
       return json4(fd);
     }
@@ -11553,8 +11753,8 @@ async function runChild(req, deps) {
   };
   const controls = [];
   const capture = () => {
-    const { promise, resolve } = Promise.withResolvers();
-    const control = { shut: false, ended: resolve, eof: promise };
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
+    const control = { shut: false, ended: resolve2, eof: promise };
     controls.push(control);
     return { capture: true, max, overflow: () => stop("ENOBUFS"), control };
   };
@@ -11647,7 +11847,7 @@ async function waitReady(fds, read, write, deadline, interrupted2) {
       return file.changed === void 0 ? [] : [file.changed(round.signal).catch(() => void 0)];
     });
     let timer;
-    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve) => timer = setTimeout(resolve, deadline - Date.now()))];
+    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve2) => timer = setTimeout(resolve2, deadline - Date.now()))];
     try {
       await Promise.race([...changes, ...expiry, interrupted2]);
     } finally {
@@ -11731,10 +11931,10 @@ async function socketSyscall(req, proc) {
   }
 }
 function interruptible2(dialing, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const abort = () => reject(new KernelError("EINTR"));
     signal.addEventListener("abort", abort, { once: true });
-    dialing.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    dialing.then(resolve2, reject).finally(() => signal.removeEventListener("abort", abort));
   });
 }
 function unnamed(domain) {
@@ -12581,7 +12781,7 @@ var WasmProcess = class {
     if (this.stopped) return "stop";
     this.stopped = sig;
     this.stops++;
-    this.resumed = new Promise((resolve) => this.wake = resolve);
+    this.resumed = new Promise((resolve2) => this.wake = resolve2);
     const blocked = this.interrupt;
     this.interrupt = new AbortController();
     blocked.abort();
@@ -12646,7 +12846,9 @@ var WasmProcess = class {
         const { ptys, jobs } = this.options;
         const owner = this.options.owners ? this.ttyOwner() : void 0;
         const guard2 = this.guarded();
-        return ptySyscall(req, { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner });
+        const { ttyFilter } = this.options;
+        const ctx = { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner, ttyFilter };
+        return ptySyscall(req, ctx);
       }
       return await this.procSyscall(req, cancelled);
     } catch (e) {
@@ -12821,7 +13023,8 @@ var WasmProcess = class {
     const tty = name2 === void 0 ? this.controllingTerminal() : this.options.jobs?.terminalNamed(name2);
     if (!tty) throw new KernelError("ENXIO");
     if (name2 !== void 0) ttyOpenable(this.guarded(), tty);
-    return this.fds.install(tty.file(), 3);
+    const file = tty.file();
+    return this.fds.install(this.options.ttyFilter?.(file) ?? file, 3);
   }
   openSealed() {
     const broker = this.options.sealed;
@@ -12861,15 +13064,8 @@ var WasmProcess = class {
   async sealedCaller() {
     const shown = await this.options.identity?.();
     const broker = this.options.sealed;
-    const tag = broker.tagOf(this.pid);
-    return {
-      pid: shown?.pid ?? this.pid,
-      ppid: shown?.ppid ?? 0,
-      uid: this.cred.euid,
-      gid: this.cred.egid,
-      ...tag !== void 0 ? { tag } : {},
-      users: broker.users
-    };
+    const ids = { pid: shown?.pid ?? this.pid, ppid: shown?.ppid ?? 0 };
+    return broker.stamp(ids, this.cred, broker.tagOf(this.pid));
   }
   guarded() {
     const { guard: guard2 } = this.options;
@@ -13377,13 +13573,13 @@ var WasmProcess = class {
     while (this.dlLock.depth > 0 && this.dlLock.owner !== owner) {
       if (this.dying) throw new KernelError("EINTR");
       const interrupt = this.interrupt.signal;
-      const gone = await new Promise((resolve) => {
+      const gone = await new Promise((resolve2) => {
         const waiter = {
           owner,
           wake: (ended) => {
             this.dlLock.waiters.delete(waiter);
             interrupt.removeEventListener("abort", recheck);
-            resolve(ended);
+            resolve2(ended);
           }
         };
         const recheck = () => waiter.wake(false);
@@ -13639,6 +13835,7 @@ function processOptions(opts, header3, hooks, created3) {
     ...inherited(opts),
     ...opts.owners ? { owners: true } : {},
     ...opts.sealed ? { sealed: opts.sealed } : {},
+    ...opts.ttyFilter ? { ttyFilter: opts.ttyFilter } : {},
     ...opts.clipboard ? { clipboard: opts.clipboard, ...clipboardName(opts) } : {},
     ...opts.readonlyAt ? { readonlyAt: opts.readonlyAt } : {},
     ...opts.dac ? { guard: { dac: opts.dac, fs: opts.fs, created: created3 } } : {},
@@ -14133,6 +14330,523 @@ function replayingHops(inner, heldMs = HELD_MS) {
   };
 }
 
+// node_modules/@ai-ecoverse/slicc-scrub/dist/index.js
+var FRAGMENT = 16;
+var MIN_VALUE = 8;
+var MIN_BASE64 = 8;
+var encoder4 = new TextEncoder();
+var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function utf82(text) {
+  return encoder4.encode(text);
+}
+function base642(bytes, padded = true) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const a = bytes[i];
+    const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const triple = a << 16 | b << 8 | c;
+    const left = bytes.length - i;
+    out += STD[triple >> 18 & 63] + STD[triple >> 12 & 63];
+    out += left > 1 ? STD[triple >> 6 & 63] : padded ? "=" : "";
+    out += left > 2 ? STD[triple & 63] : padded ? "=" : "";
+  }
+  return out;
+}
+function urlSafe(text) {
+  return text.replace(/\+/g, "-").replace(/\//g, "_");
+}
+function hex2(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function embedded(bytes, offset) {
+  const shifted = new Uint8Array(offset + bytes.length);
+  shifted.set(bytes, offset);
+  const encoded = base642(shifted);
+  const first = Math.ceil(8 * offset / 6);
+  const last = Math.floor(8 * (offset + bytes.length) / 6);
+  return encoded.slice(first, last);
+}
+function unicode(value, upper) {
+  let out = "";
+  for (let i = 0; i < value.length; i++) {
+    const unit = value.charCodeAt(i);
+    if (unit === 34) out += '\\"';
+    else if (unit === 92) out += "\\\\";
+    else if (unit < 32 || unit > 126) {
+      const code = unit.toString(16).padStart(4, "0");
+      out += `\\u${upper ? code.toUpperCase() : code}`;
+    } else out += value[i];
+  }
+  return out;
+}
+function percent(value) {
+  let component;
+  try {
+    component = encodeURIComponent(value);
+  } catch {
+    return [];
+  }
+  const lower = component.replace(/%[0-9A-F]{2}/g, (escape) => escape.toLowerCase());
+  const plus = component.replace(/%20/g, "+");
+  let form = "";
+  for (const byte of utf82(value)) {
+    const char = String.fromCharCode(byte);
+    if (/[A-Za-z0-9*\-._]/.test(char)) form += char;
+    else if (byte === 32) form += "+";
+    else form += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+  }
+  return [component, lower, plus, form];
+}
+function html(value, apostrophe) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, apostrophe);
+}
+function encodings(bytes) {
+  const standard = [base642(bytes), base642(bytes, false)];
+  for (const offset of [0, 1, 2]) {
+    const run2 = embedded(bytes, offset);
+    if (run2.length >= MIN_BASE64) standard.push(run2);
+  }
+  return [...standard, ...standard.map(urlSafe)];
+}
+function shapes(value) {
+  const raw = utf82(value);
+  const seen = /* @__PURE__ */ new Set([value]);
+  const out = [];
+  if (raw.length < FRAGMENT) out.push({ bytes: raw, form: "raw" });
+  for (let offset = 0; raw.length >= FRAGMENT && offset + FRAGMENT <= raw.length; offset++) {
+    out.push({ bytes: raw.subarray(offset, offset + FRAGMENT), form: "fragment", offset });
+  }
+  const add = (text, form) => {
+    if (seen.has(text)) return;
+    seen.add(text);
+    out.push({ bytes: utf82(text), form });
+  };
+  const json5 = JSON.stringify(value).slice(1, -1);
+  for (const text of [
+    json5,
+    json5.replace(/\//g, "\\/"),
+    unicode(value, false),
+    unicode(value, true)
+  ]) {
+    add(text, "json");
+  }
+  for (const text of percent(value)) add(text, "percent");
+  for (const text of [html(value, "&#39;"), html(value, "&#x27;")]) add(text, "html");
+  for (const text of encodings(raw)) add(text, "base64");
+  add(hex2(raw), "hex");
+  add(hex2(raw).toUpperCase(), "hex");
+  return out;
+}
+function wrappable(form) {
+  return form === "base64" || form === "hex";
+}
+var Automaton = class {
+  edges = /* @__PURE__ */ new Map();
+  fail = [0];
+  depth = [0];
+  children = [0];
+  out = [[]];
+  dict = [-1];
+  lengths = [];
+  add(bytes) {
+    let node = 0;
+    for (const byte of bytes) {
+      const key = node * 256 + byte;
+      let next2 = this.edges.get(key);
+      if (next2 === void 0) {
+        next2 = this.depth.length;
+        this.edges.set(key, next2);
+        this.fail.push(0);
+        this.depth.push(this.depth[node] + 1);
+        this.children.push(0);
+        this.children[node] += 1;
+        this.out.push([]);
+        this.dict.push(-1);
+      }
+      node = next2;
+    }
+    const id2 = this.lengths.length;
+    this.lengths.push(bytes.length);
+    this.out[node].push(id2);
+    return id2;
+  }
+  build() {
+    const queue = [];
+    const byNode = /* @__PURE__ */ new Map();
+    for (const [key, child] of this.edges) {
+      const parent = Math.floor(key / 256);
+      const list = byNode.get(parent) ?? [];
+      list.push([key % 256, child]);
+      byNode.set(parent, list);
+    }
+    for (const [, child] of byNode.get(0) ?? []) queue.push(child);
+    for (let head = 0; head < queue.length; head++) {
+      const node = queue[head];
+      const fallback = this.fail[node];
+      this.dict[node] = this.out[fallback].length > 0 ? fallback : this.dict[fallback];
+      for (const [byte, child] of byNode.get(node) ?? []) {
+        let state = fallback;
+        let target = this.edges.get(state * 256 + byte);
+        while (target === void 0 && state > 0) {
+          state = this.fail[state];
+          target = this.edges.get(state * 256 + byte);
+        }
+        this.fail[child] = target ?? 0;
+        queue.push(child);
+      }
+    }
+  }
+  step(state, byte) {
+    let current = state;
+    for (; ; ) {
+      const next2 = this.edges.get(current * 256 + byte);
+      if (next2 !== void 0) return next2;
+      if (current === 0) return 0;
+      current = this.fail[current];
+    }
+  }
+  matches(state, visit) {
+    for (let node = state; node > 0; node = this.dict[node]) {
+      for (const id2 of this.out[node]) visit(id2);
+    }
+  }
+  partials(state, length2, visit) {
+    for (let node = state; node > 0; node = this.fail[node]) {
+      if (this.children[node] > 0) visit(length2 - this.depth[node]);
+    }
+  }
+};
+var RANK = {
+  raw: 0,
+  fragment: 1,
+  json: 2,
+  percent: 3,
+  html: 4,
+  base64: 5,
+  hex: 6,
+  wrapped: 7
+};
+var CR2 = 13;
+var LF2 = 10;
+var EMPTY2 = new Uint8Array(0);
+function register(automaton, sources, ids, bytes, source) {
+  const key = Array.from(bytes).join(",");
+  let id2 = ids.get(key);
+  if (id2 === void 0) {
+    id2 = automaton.add(bytes);
+    ids.set(key, id2);
+    sources[id2] = [];
+  }
+  sources[id2].push(source);
+}
+function prepare(secrets) {
+  const main = new Automaton();
+  const wrap = new Automaton();
+  const sources = [];
+  const wrapSources = [];
+  const ids = /* @__PURE__ */ new Map();
+  const wrapIds = /* @__PURE__ */ new Map();
+  const values = secrets.map((secret) => utf82(secret.value));
+  secrets.forEach((secret, index) => {
+    if (typeof secret.value !== "string" || values[index].length < MIN_VALUE) {
+      throw new RangeError(`the value of ${secret.name} is shorter than ${MIN_VALUE} bytes`);
+    }
+    for (const shape of shapes(secret.value)) {
+      const source = { secret: index, form: shape.form, offset: shape.offset };
+      register(main, sources, ids, shape.bytes, source);
+      if (wrappable(shape.form)) register(wrap, wrapSources, wrapIds, shape.bytes, source);
+    }
+  });
+  main.build();
+  wrap.build();
+  const replacements = secrets.map((secret) => [
+    utf82(secret.placeholder),
+    utf82(`[redacted:${secret.name}]`)
+  ]);
+  return { secrets, values, main, wrap, sources, wrapSources, replacements };
+}
+function better(a, b) {
+  if (!b) return true;
+  if (a.end !== b.end) return a.end > b.end;
+  if (a.rank !== b.rank) return a.rank < b.rank;
+  return a.secret < b.secret;
+}
+function resolve(c, input, start2, end, source) {
+  if (source.form !== "fragment") {
+    return {
+      start: start2,
+      end,
+      secret: source.secret,
+      form: source.form,
+      rank: RANK[source.form],
+      growing: false
+    };
+  }
+  const value = c.values[source.secret];
+  let stop = end;
+  let at = source.offset + FRAGMENT;
+  while (stop < input.length && at < value.length && input[stop] === value[at]) {
+    stop++;
+    at++;
+  }
+  const form = source.offset === 0 && at === value.length ? "raw" : "fragment";
+  const growing = stop === input.length && at < value.length;
+  return { start: start2, end: stop, secret: source.secret, form, rank: RANK[form], growing };
+}
+function keep(best, candidate) {
+  if (better(candidate, best.get(candidate.start))) best.set(candidate.start, candidate);
+}
+function scanMain(c, input, best, partials) {
+  let state = 0;
+  for (let i = 0; i < input.length; i++) {
+    state = c.main.step(state, input[i]);
+    c.main.matches(state, (id2) => {
+      const start2 = i + 1 - c.main.lengths[id2];
+      for (const source of c.sources[id2]) {
+        const candidate = resolve(c, input, start2, i + 1, source);
+        if (candidate.growing) partials.push(candidate.start);
+        keep(best, candidate);
+      }
+    });
+  }
+  c.main.partials(state, input.length, (start2) => partials.push(start2));
+}
+function scanWrapped(c, input, best, partials) {
+  const map = [];
+  for (let i = 0; i < input.length; i++) if (input[i] !== CR2 && input[i] !== LF2) map.push(i);
+  if (map.length === input.length) return;
+  let state = 0;
+  for (let v = 0; v < map.length; v++) {
+    state = c.wrap.step(state, input[map[v]]);
+    c.wrap.matches(state, (id2) => {
+      const first = v + 1 - c.wrap.lengths[id2];
+      const start2 = map[first];
+      const end = map[v] + 1;
+      const wrapped = end - start2 !== c.wrap.lengths[id2];
+      for (const source of c.wrapSources[id2]) {
+        const form = wrapped ? "wrapped" : source.form;
+        keep(best, { start: start2, end, secret: source.secret, form, rank: RANK[form], growing: false });
+      }
+    });
+  }
+  c.wrap.partials(state, map.length, (start2) => partials.push(map[start2]));
+}
+function count(c, hits, candidate) {
+  const name2 = c.secrets[candidate.secret].name;
+  const key = `${name2}\0${candidate.form}`;
+  const hit = hits.get(key) ?? { name: name2, form: candidate.form, count: 0 };
+  hit.count += 1;
+  hits.set(key, hit);
+}
+function concat5(parts2) {
+  let length2 = 0;
+  for (const part of parts2) length2 += part.length;
+  const out = new Uint8Array(length2);
+  let at = 0;
+  for (const part of parts2) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+function pass(c, input, final) {
+  const best = /* @__PURE__ */ new Map();
+  const partials = [];
+  scanMain(c, input, best, partials);
+  scanWrapped(c, input, best, partials);
+  const holds = final ? [] : [...new Set(partials)].sort((a, b) => a - b);
+  const starts = [...best.keys()].sort((a, b) => a - b);
+  const parts2 = [];
+  const hits = /* @__PURE__ */ new Map();
+  let pos = 0;
+  let cut = input.length;
+  let s = 0;
+  let h = 0;
+  for (; ; ) {
+    while (s < starts.length && starts[s] < pos) s++;
+    while (h < holds.length && holds[h] < pos) h++;
+    const hold = h < holds.length ? holds[h] : Infinity;
+    const next2 = s < starts.length ? starts[s] : Infinity;
+    if (hold <= next2) {
+      cut = Math.min(hold, input.length);
+      break;
+    }
+    const candidate = best.get(next2);
+    parts2.push(
+      input.subarray(pos, next2),
+      c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1]
+    );
+    count(c, hits, candidate);
+    pos = candidate.end;
+  }
+  parts2.push(input.subarray(pos, cut));
+  return { output: concat5(parts2), cut, hits };
+}
+function merge(into, from) {
+  for (const [key, hit] of from) {
+    const known = into.get(key);
+    if (known) known.count += hit.count;
+    else into.set(key, { ...hit });
+  }
+}
+function compile(secrets, options = {}) {
+  const c = prepare(secrets.map((secret) => ({ ...secret })));
+  const decoder4 = new TextDecoder();
+  const idleMs = options.idleMs ?? 250;
+  const scrubBytes = (input) => {
+    if (c.secrets.length === 0) return { bytes: input.slice(), hits: [] };
+    const result = pass(c, input, true);
+    return { bytes: result.output, hits: [...result.hits.values()] };
+  };
+  return {
+    version: options.version ?? 0,
+    idleMs,
+    size: c.main.lengths.length,
+    bytes: scrubBytes,
+    text(input) {
+      const { bytes, hits } = scrubBytes(utf82(input));
+      return { text: decoder4.decode(bytes), hits };
+    },
+    stream() {
+      let pending = EMPTY2;
+      const hits = /* @__PURE__ */ new Map();
+      const run2 = (final) => {
+        if (c.secrets.length === 0 || pending.length === 0) {
+          const out = pending;
+          pending = EMPTY2;
+          return out;
+        }
+        const result = pass(c, pending, final);
+        merge(hits, result.hits);
+        pending = pending.slice(result.cut);
+        return result.output;
+      };
+      return {
+        push(chunk2) {
+          pending = concat5([pending, chunk2]);
+          return run2(false);
+        },
+        idle() {
+          return pending.length < FRAGMENT ? run2(true) : EMPTY2;
+        },
+        end() {
+          return run2(true);
+        },
+        get hits() {
+          return [...hits.values()];
+        }
+      };
+    }
+  };
+}
+
+// src/kernel/scrub-file.ts
+var SCRUB_IDLE_MS = 50;
+var encoder5 = new TextEncoder();
+function scrubberOf(secrets) {
+  const usable = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
+  return usable.length > 0 ? compile(usable, { idleMs: SCRUB_IDLE_MS }) : void 0;
+}
+async function writeAll2(file, bytes, signal) {
+  const write = file.write;
+  for (let at = 0; at < bytes.length; ) {
+    at += await write.call(file, bytes.subarray(at), at === 0 ? signal : void 0);
+  }
+}
+function bound(file, key) {
+  const method = file[key];
+  return typeof method === "function" ? { [key]: method.bind(file) } : {};
+}
+function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
+  const file = inner.file;
+  const stream = scrubber.stream();
+  let queue = Promise.resolve();
+  let timer;
+  let failed3;
+  const raise = () => {
+    if (failed3 === void 0) return;
+    const err = failed3;
+    failed3 = void 0;
+    throw err;
+  };
+  const enqueue = (bytes, signal) => {
+    const next2 = queue.then(() => bytes.length > 0 ? writeAll2(file, bytes, signal) : void 0);
+    queue = next2.catch(() => void 0);
+    return next2;
+  };
+  const release = () => {
+    timer = void 0;
+    enqueue(stream.idle()).catch((err) => {
+      failed3 = err;
+    });
+  };
+  return new OpenFile({
+    ...bound(file, "read"),
+    ...bound(file, "peek"),
+    ...bound(file, "poll"),
+    ...bound(file, "changed"),
+    ...bound(file, "stat"),
+    ...file.tty ? { tty: file.tty } : {},
+    ...file.clipboard ? { clipboard: file.clipboard } : {},
+    ...file.write ? {
+      write: async (bytes, signal) => {
+        if (timer !== void 0) clearTimeout(timer);
+        raise();
+        await enqueue(stream.push(bytes), signal);
+        timer = setTimeout(release, idleMs);
+        return bytes.length;
+      }
+    } : {},
+    flush: async () => {
+      await queue;
+      raise();
+      await file.flush?.();
+    },
+    close: async () => {
+      if (timer !== void 0) clearTimeout(timer);
+      let failure2;
+      try {
+        await enqueue(stream.end());
+        raise();
+      } catch (err) {
+        failure2 = { err };
+      }
+      await inner.release();
+      if (failure2) throw failure2.err;
+    }
+  });
+}
+function scrubbedAll(file, scrubbers) {
+  return scrubbers.reduce((inner, scrubber) => scrubbed(inner, scrubber), file);
+}
+function stdioFiles(fds) {
+  const files = /* @__PURE__ */ new Set();
+  for (const fd of [1, 2]) {
+    try {
+      files.add(fds.get(fd));
+    } catch {
+    }
+  }
+  return files;
+}
+function scrubStdio(fds, scrubber) {
+  const wrapped = /* @__PURE__ */ new Map();
+  const stdio = stdioFiles(fds);
+  for (const fd of fds.numbers()) {
+    const original = fds.get(fd);
+    if (!stdio.has(original) && !original.file.tty) continue;
+    const known = wrapped.get(original);
+    const flags2 = fds.statusFlags(fd);
+    const wrapper = known ? known.retain() : scrubbed(original.retain(), scrubber);
+    wrapped.set(original, wrapper);
+    fds.installAt(fd, wrapper);
+    if (flags2 !== void 0) fds.setStatusFlags(fd, flags2);
+  }
+}
+
 // src/kernel/sealed.ts
 var SEALED_MAX_BYTES = 64 * 1024;
 var SEALED_TIMEOUT_MS = 1e4;
@@ -14146,7 +14860,7 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "cancel",
   "materialize"
 ]);
-var encoder4 = new TextEncoder();
+var encoder6 = new TextEncoder();
 var decoder3 = new TextDecoder("utf-8", { fatal: true });
 function parseSealed(bytes) {
   try {
@@ -14162,11 +14876,16 @@ function parseSealed(bytes) {
     const req = parsed2;
     if (req.v !== 1 || typeof req.op !== "string" || !SEALED_OPS.has(req.op))
       throw new KernelError("EINVAL");
+    if (req.op === "materialize" && !materializable(req)) throw new KernelError("EINVAL");
     return req;
   } finally {
     bytes.fill(0);
   }
 }
+function materializable(req) {
+  if (req.shellGrants !== true && !isStrings(req.names)) return false;
+  return isStrings(req.argv) && typeof req.path === "string" && typeof req.cwd === "string";
+}
 function errorReply(code, message3) {
   return { v: 1, error: { code, message: message3 } };
 }
@@ -14210,12 +14929,14 @@ var SealedChannel = class {
     const timer = setTimeout(() => control.abort("timeout"), this.broker.timeoutMs);
     const req = { ...fields, v: 1, op: fields.op, caller };
     const flight = { control, done: Promise.resolve() };
-    flight.done = this.answer(req, control.signal).then((reply) => {
+    flight.done = this.answer(req, control.signal).then(async (reply) => {
       clearTimeout(timer);
       gone.removeEventListener("abort", withdraw);
+      if (reply && req.op === "materialize")
+        await this.broker.tickets.record(req, reply, caller.pid);
       if (this.inflight !== flight) return;
       this.inflight = void 0;
-      if (reply) this.reply = encoder4.encode(serialized(reply));
+      if (reply) this.reply = encoder6.encode(serialized(reply));
     });
     this.inflight = flight;
     return length2;
@@ -14223,8 +14944,8 @@ var SealedChannel = class {
   async answer(req, signal) {
     const hook = this.broker.hook;
     if (!hook) return errorReply("ENOTCONN", "no vault is connected");
-    const stopped = new Promise((resolve) => {
-      signal.addEventListener("abort", () => resolve(void 0), { once: true });
+    const stopped = new Promise((resolve2) => {
+      signal.addEventListener("abort", () => resolve2(void 0), { once: true });
     });
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
@@ -14279,17 +15000,60 @@ var SealedChannel = class {
     this.reply = void 0;
   }
 };
+function swapOf(reply) {
+  if (!isRecord(reply) || reply.error !== void 0) return void 0;
+  const values = stringRecord(reply.values);
+  const placeholders = stringRecord(reply.placeholders);
+  return values && placeholders ? { values, placeholders } : void 0;
+}
 var SealedBroker = class {
   hook;
   users;
   timeoutMs;
   tagOf;
+  tickets = new TicketBook();
+  userOf = async () => void 0;
   constructor(hook, users, timeoutMs = SEALED_TIMEOUT_MS, tagOf = () => void 0) {
     this.hook = hook;
     this.users = users;
     this.timeoutMs = timeoutMs;
     this.tagOf = tagOf;
   }
+  async stamp(ids, cred, tag) {
+    const user = await this.userOf(cred.euid).catch(() => void 0);
+    return {
+      pid: ids.pid,
+      ppid: ids.ppid,
+      uid: cred.euid,
+      gid: cred.egid,
+      ...user !== void 0 ? { user } : {},
+      groups: [...cred.groups],
+      users: this.users,
+      ...tag !== void 0 ? { tag } : {}
+    };
+  }
+  async consume(fields) {
+    const { hook } = this;
+    if (!hook) return void 0;
+    const control = new AbortController();
+    const timer = setTimeout(() => control.abort("timeout"), this.timeoutMs);
+    const stopped = new Promise((resolve2) => {
+      control.signal.addEventListener("abort", () => resolve2(void 0), { once: true });
+    });
+    const req = {
+      ...fields,
+      v: 1,
+      op: "materializeConsume",
+      caller: fields.stamp
+    };
+    try {
+      const asked = Promise.resolve().then(() => hook(req, { signal: control.signal })).then(swapOf, () => void 0);
+      return await Promise.race([asked, stopped]);
+    } finally {
+      clearTimeout(timer);
+      control.abort("done");
+    }
+  }
   open() {
     const channel = new SealedChannel(this);
     return new OpenFile({
@@ -14788,11 +15552,11 @@ function codeOf3(err) {
 }
 function wait(ms, signal) {
   if (signal.aborted) return Promise.resolve();
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const done4 = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done4);
-      resolve();
+      resolve2();
     };
     const timer = setTimeout(done4, ms);
     signal.addEventListener("abort", done4, { once: true });
@@ -15119,11 +15883,11 @@ async function resize(h, path, size) {
   }
 }
 function sleep(ms, signal) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const done4 = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done4);
-      resolve();
+      resolve2();
     };
     const timer = setTimeout(done4, ms);
     signal.addEventListener("abort", done4);
@@ -15206,7 +15970,7 @@ var PORT_DEAD_MS = 1e4;
 var PORT_LINGER_MS = 1e3;
 function timed(transport, ms) {
   const inflight = /* @__PURE__ */ new Set();
-  const guard2 = (name2, run2, late, expire) => new Promise((resolve, reject) => {
+  const guard2 = (name2, run2, late, expire) => new Promise((resolve2, reject) => {
     let expired = false;
     const running = run2();
     inflight.add(running);
@@ -15223,7 +15987,7 @@ function timed(transport, ms) {
       (value) => {
         clearTimeout(timer);
         if (expired) late?.(value);
-        resolve(value);
+        resolve2(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -15358,7 +16122,7 @@ var PortTransport = class {
   ask(message3, bytes = 0, transfer = []) {
     const id2 = ++this.next;
     if (this.dead) return Promise.reject(fsError2("ENOTCONN", this.dead));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = setTimeout(
         () => {
           this.waiting.delete(id2);
@@ -15372,7 +16136,7 @@ var PortTransport = class {
         clearTimeout(timer);
         this.waiting.delete(id2);
         if (reply.error) reject(fsError2(reply.error.code ?? "EIO", reply.error.message ?? ""));
-        else resolve(reply);
+        else resolve2(reply);
       });
       try {
         this.port.postMessage({ id: id2, ...message3 }, transfer);
@@ -15401,7 +16165,7 @@ var PortTransport = class {
       this.fail("the folder's watch ended");
       return Promise.resolve();
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const finish = () => {
         this.waiting.delete(id2);
         signal.removeEventListener("abort", stop);
@@ -15412,7 +16176,7 @@ var PortTransport = class {
           this.port.postMessage({ id: id2, op: "unwatch" });
         } catch {
         }
-        resolve();
+        resolve2();
       };
       this.watchBeat();
       this.waiting.set(id2, (reply) => {
@@ -15420,7 +16184,7 @@ var PortTransport = class {
         if (reply.event) return onEvent(reply.event);
         finish();
         if (reply.error) reject(fsError2(reply.error.code ?? "ENOTCONN", reply.error.message ?? ""));
-        else resolve();
+        else resolve2();
       });
       signal.addEventListener("abort", stop, { once: true });
       try {
@@ -15533,10 +16297,10 @@ var ChunkedBytes = class {
   }
   truncate(size) {
     if (size < this.size) {
-      const keep = Math.ceil(size / CHUNK3);
-      this.chunks.length = Math.min(this.chunks.length, keep);
-      const tail = this.chunks[keep - 1];
-      const from = size - (keep - 1) * CHUNK3;
+      const keep2 = Math.ceil(size / CHUNK3);
+      this.chunks.length = Math.min(this.chunks.length, keep2);
+      const tail = this.chunks[keep2 - 1];
+      const from = size - (keep2 - 1) * CHUNK3;
       if (tail && from < tail.length) tail.fill(0, from);
     }
     this.size = size;
@@ -15781,8 +16545,8 @@ function importedMemory(bytes) {
       at = end;
       continue;
     }
-    const count = u32();
-    for (let i = 0; i < count; i++) {
+    const count2 = u32();
+    for (let i = 0; i < count2; i++) {
       const module = name2();
       const field3 = name2();
       const kind = bytes[at++];
@@ -16211,7 +16975,7 @@ ${lines2}
     const withdraw = () => control.abort("withdrawn");
     requester.addEventListener("abort", withdraw, { once: true });
     const aborted2 = new Promise(
-      (resolve) => control.signal.addEventListener("abort", () => resolve("aborted"), { once: true })
+      (resolve2) => control.signal.addEventListener("abort", () => resolve2("aborted"), { once: true })
     );
     try {
       const answered2 = Promise.resolve().then(() => approve(req, { signal: control.signal })).catch(() => "deny");
@@ -16337,7 +17101,7 @@ var LAYOUT = [
 ];
 var LOAD_SAMPLE_MS = 5e3;
 var LOAD_WINDOWS_MS = [6e4, 3e5, 9e5];
-var encoder5 = new TextEncoder();
+var encoder7 = new TextEncoder();
 var USERS_MODES = ["off", "report", "enforce"];
 function usersMode(mode = "off") {
   if (USERS_MODES.includes(mode)) return mode;
@@ -16368,6 +17132,30 @@ function shebang(head) {
   if (head[0] !== 35 || head[1] !== 33) return void 0;
   return new TextDecoder().decode(head.subarray(0, SHEBANG_MAX)).slice(2).split("\n")[0].trim().split(/[ \t]+/);
 }
+async function rootOnly(fs, path) {
+  const names = chain(path);
+  for (const [i, at] of names.entries()) {
+    const st = await fs.lstat(at).catch(() => void 0);
+    const kind = i === names.length - 1 ? st?.isFile : st?.isDirectory;
+    if (!kind || st?.uid !== 0 || (st.mode & 18) !== 0) return false;
+  }
+  return true;
+}
+function plainEnv(words2) {
+  const next2 = words2[1];
+  if (baseName(words2[0] ?? "") !== "env" || next2 === void 0) return false;
+  return next2 === "-S" || !next2.startsWith("-") && !next2.includes("=");
+}
+function shebangCommand(words2) {
+  if (!plainEnv(words2)) {
+    const arg2 = words2.slice(1).join(" ");
+    return { interp: words2[0], args: arg2 ? [arg2] : [] };
+  }
+  const split2 = words2[1] === "-S";
+  const [interp, ...rest2] = words2.slice(split2 ? 2 : 1);
+  const arg = rest2.join(" ");
+  return { interp, args: split2 ? rest2 : arg ? [arg] : [] };
+}
 function interpreter(head) {
   const words2 = shebang(head);
   if (!words2) return "node";
@@ -16421,7 +17209,7 @@ function childHandle(handle) {
     onState: (listener) => handle.onState(listener)
   };
 }
-function concat5(chunks) {
+function concat6(chunks) {
   const out = new Uint8Array(chunks.reduce((n, chunk2) => n + chunk2.length, 0));
   let offset = 0;
   for (const chunk2 of chunks) {
@@ -16453,6 +17241,13 @@ var Launcher = class {
   unwatchScopes = () => void 0;
   warned = /* @__PURE__ */ new Set();
   compiled = /* @__PURE__ */ new Map();
+  texts = /* @__PURE__ */ new Map();
+  integrity;
+  scannedFs;
+  get scanned() {
+    this.scannedFs ??= this.verifiedFs(this.base);
+    return this.scannedFs;
+  }
   processes = /* @__PURE__ */ new Map();
   zombies = /* @__PURE__ */ new Set();
   orphans = /* @__PURE__ */ new Set();
@@ -16500,6 +17295,7 @@ var Launcher = class {
   usersMode;
   dac;
   sealed;
+  scrubs = /* @__PURE__ */ new Map();
   clipboard;
   rootFs;
   fileWatches;
@@ -16523,6 +17319,8 @@ var Launcher = class {
       void 0,
       (pid) => this.tagOf(pid)
     );
+    this.sealed.tickets.normalise = (path) => physicalPathAsync(this.base, path);
+    this.sealed.userOf = async (uid) => (await this.users.lookup(uid))?.name;
     if (this.owners) options.fs.trackOwners?.();
     this.mounts = new MountTable({
       open: (type, spec) => this.driver(type, spec),
@@ -16556,7 +17354,7 @@ var Launcher = class {
     if (options.uplink) this.net.useUplink({ uplink: options.uplink, routes: this.routes });
     enableNetwork(this.net, {
       transport: this.transport,
-      engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
+      engine: kernelTlsEngine(packageTlsEngine(this.verifiedFs(options.fs), this.modulesDir)),
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
@@ -16591,6 +17389,16 @@ var Launcher = class {
     this.prefixes = protectedPrefixes(options.protect?.paths ?? []);
     this.processFs = this.prefixes.length > 0 ? new ProtectedFs(this.prefixes).view(this.fs) : this.fs;
     options.fs.protect?.(this.prefixes);
+    const integrity = options.protect?.integrity;
+    integrityOptions(integrity);
+    if (integrity && this.prefixes.length > 0) {
+      this.integrity = new Integrity(
+        this.prefixes,
+        options.fs,
+        integrity,
+        (event) => options.onDenial?.(event)
+      );
+    }
     this.users = new UserDb(this.fs, this.owners);
     this.sudoer = new Sudo({
       fs: this.fs,
@@ -16636,7 +17444,7 @@ var Launcher = class {
   commands(scope = "") {
     let found = this.catalogs.get(scope);
     if (!found) {
-      found = this.roots(scope).then((roots) => scanCommands(this.base, roots)).then((commands) => commands.set(SUDO_COMMAND.name, SUDO_COMMAND));
+      found = this.roots(scope).then((roots) => scanCommands(this.scanned, roots)).then((commands) => commands.set(SUDO_COMMAND.name, SUDO_COMMAND));
       this.catalogs.set(scope, found);
     }
     return found;
@@ -16644,7 +17452,7 @@ var Launcher = class {
   ownCommands(scope) {
     let found = this.ownCatalogs.get(scope);
     if (!found) {
-      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.base, roots)).then((commands) => new Set(commands.keys()));
+      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.scanned, roots)).then((commands) => new Set(commands.keys()));
       this.ownCatalogs.set(scope, found);
     }
     return found;
@@ -16653,7 +17461,7 @@ var Launcher = class {
     let found = this.binfmts.get(scope);
     if (!found) {
       found = this.roots(scope).then(
-        (roots) => scanBinfmts(this.base, roots, (message3) => {
+        (roots) => scanBinfmts(this.scanned, roots, (message3) => {
           if (this.warned.has(message3)) return;
           this.warned.add(message3);
           console.warn(message3);
@@ -16761,21 +17569,26 @@ var Launcher = class {
     const binfmt = isWasm(head) ? void 0 : binfmtOf(await this.interpreters(scope), script);
     const words2 = shebang(head) ?? (binfmt ? [binfmt] : void 0);
     if (!words2) return void 0;
-    if (baseName(words2[0]) === "env") words2.shift();
-    const [interp, ...rest2] = words2;
-    const arg = rest2.join(" ");
-    const passed = [...arg ? [arg] : [], command ? script : file, ...argv.slice(1)];
-    const found = interp ? await this.resolve(interp, interp, cwd, scope) : void 0;
+    const { interp, args } = shebangCommand(words2);
+    const passed = [...args, command ? script : file, ...argv.slice(1)];
+    if (!interp) return void 0;
+    const found = await this.resolve(interp, interp, cwd, scope);
     if (!found) {
-      if (!interp || depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp, cwd, scope)) {
+      if (depth >= MAX_INTERPRETERS || !await this.scriptCommand(interp, cwd, scope)) {
         return void 0;
       }
       const inner = await this.interpreted(interp, [interp, ...passed], cwd, scope, depth + 1);
       const via = [interp, ...inner?.via ?? []];
-      return inner && { ...inner, target: withScriptEnv(inner.target, command), via };
+      const sources = [script, ...inner?.sources ?? []];
+      return inner && { ...inner, target: withScriptEnv(inner.target, command), via, sources };
     }
     const target = withScriptEnv(found, command);
-    return { target, args: [...target.prefix ?? [], ...passed], via: [interp] };
+    return {
+      target,
+      args: [...target.prefix ?? [], ...passed],
+      via: [interp],
+      sources: [script]
+    };
   }
   async plan(file, argv, cwd, scope, argv0) {
     const found = await this.resolve(file, argv[0] ?? file, cwd, scope);
@@ -16801,13 +17614,106 @@ var Launcher = class {
       await need(g, "exec", this.fs.resolvePath(req.cwd, file), want);
     }
   }
+  async checkedPlan(req, { ppid, cred, scope }, fds) {
+    const planned = await this.plan(req.file, req.argv, req.cwd, scope, req.argv0);
+    try {
+      await this.mayExec(cred, { ...req, pid: ppid }, planned);
+    } catch (err) {
+      await fds.closeAll();
+      throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+    }
+    if (planned) return planned;
+    await fds.closeAll();
+    throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
+  }
+  async ticketFile(req, fds) {
+    if (req.file.startsWith("/")) return physicalPathAsync(this.base, req.file);
+    await fds.closeAll();
+    throw new SpawnError("EACCES");
+  }
+  takeTicket(req) {
+    if (!(TICKET_ENV in req.env)) return void 0;
+    return this.sealed.tickets.take(req.env[TICKET_ENV] ?? "") ?? null;
+  }
+  async redeemed(req, who, planned, fds) {
+    if (who.booked === void 0) return { env: req.env };
+    try {
+      const redeemed = await this.redeem(req, who, planned);
+      if (redeemed.scrub) scrubStdio(fds, redeemed.scrub);
+      return redeemed;
+    } catch {
+      await fds.closeAll();
+      throw new SpawnError("EACCES");
+    }
+  }
+  async redeem(req, { ppid, cred, scope, booked }, planned) {
+    const { [TICKET_ENV]: ticket = "", ...env } = req.env;
+    const caller = this.jobs.shown(ppid);
+    const named = typeof req.argv0 === "string" && !planned.script && !planned.target.fixed;
+    const argv = named ? [req.argv0, ...req.argv.slice(1)] : req.argv;
+    const exact = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
+    if (!exact) throw new SpawnError("EACCES");
+    const { requested: path, requestedCwd: cwd, path: resolved2 } = booked;
+    const pid = this.nextPid++;
+    const ids = { pid: req.exec ? caller : pid, ppid: caller };
+    const stamp = await this.sealed.stamp(ids, cred, this.tagOf(ppid));
+    const interpreters = await this.interpreterChain(planned, booked.cwd, scope);
+    const trusted = this.usersMode === "enforce" && await this.trustedFiles(planned, req.file, booked.cwd, scope);
+    const swap = await this.sealed.consume({
+      ticket,
+      stamp,
+      path,
+      resolved: resolved2,
+      argv,
+      cwd,
+      interpreters,
+      trusted
+    });
+    if (!swap) throw new SpawnError("EACCES");
+    const secrets = [];
+    for (const [name2, placeholder] of Object.entries(swap.placeholders)) {
+      const value = swap.values[name2];
+      if (value === void 0 || env[name2] !== placeholder) continue;
+      env[name2] = value;
+      secrets.push({ name: name2, value, placeholder });
+    }
+    const scrub = scrubberOf(secrets);
+    return { env, pid, cwd: booked.cwd, ...scrub ? { scrub } : {} };
+  }
+  async interpreterChain(planned, cwd, scope) {
+    const out = [];
+    for (const entry of planned.via ?? []) {
+      if (entry.includes("/")) {
+        out.push(await physicalPathAsync(this.base, this.fs.resolvePath(cwd, entry)));
+        continue;
+      }
+      const script = (await this.scriptCommand(entry, cwd, scope))?.script;
+      out.push(
+        await physicalPathAsync(this.base, script ?? await this.commandFile(entry, cwd, scope))
+      );
+    }
+    return out;
+  }
+  async commandFile(name2, cwd, scope) {
+    const scoped = await this.resolve(name2, name2, cwd, scope);
+    const system = scope === "" ? scoped : await this.resolve(name2, name2, cwd, "");
+    if (!scoped || system?.glue === scoped.glue) return `/usr/bin/${name2}`;
+    return scoped.glue;
+  }
+  async trustedFiles(planned, file, cwd, scope) {
+    const files = await this.backingOf(planned, file, cwd, scope);
+    for (const at of files) {
+      if (!await rootOnly(this.base, await physicalPathAsync(this.base, at))) return false;
+    }
+    return true;
+  }
   async grantedCwd(caller, cwd) {
     const real = await physicalPathAsync(this.base, cwd).catch(() => void 0);
     return real === cwd && await this.sudoer.reachable(caller, cwd);
   }
   async binfmtManifests(scripts) {
     const sources = /* @__PURE__ */ new Map();
-    const binfmts = await scanBinfmts(this.base, await this.roots(), void 0, sources);
+    const binfmts = await scanBinfmts(this.scanned, await this.roots(), void 0, sources);
     const manifests = [];
     for (const script of scripts) {
       const head = await this.head(script);
@@ -16819,13 +17725,15 @@ var Launcher = class {
   }
   async backing(file, cwd) {
     const planned = await this.plan(file, [file], cwd, "");
-    if (!planned) return void 0;
+    return planned && this.backingOf(planned, file, cwd, "");
+  }
+  async backingOf(planned, file, cwd, scope) {
     const { glue, wasm, imports } = planned.target;
     const files = [glue, wasm, ...imports ? [imports] : []];
     const scripts = [];
     for (const name2 of [file, ...planned.via ?? []]) {
       if (name2.includes("/") && !COMMAND2.test(name2)) scripts.push(this.fs.resolvePath(cwd, name2));
-      const script = (await this.scriptCommand(name2, cwd, ""))?.script;
+      const script = (await this.scriptCommand(name2, cwd, scope))?.script;
       if (script) scripts.push(script);
     }
     files.push(...scripts, ...await this.binfmtManifests(scripts));
@@ -16842,25 +17750,72 @@ var Launcher = class {
     if (!head || head[0] === 35 && head[1] === 33) return "ENOENT";
     return binfmtOf(await this.interpreters(scope), path) ? "ENOENT" : "ENOEXEC";
   }
-  module(path) {
-    return this.base.stat(path).then((st) => {
-      const key = `${path}:${st.size}:${st.mtime.getTime()}`;
-      let module = this.compiled.get(key);
-      if (!module) {
-        module = this.base.readFileBuffer(path).then(async (bytes) => {
-          const memory = importedMemory(bytes);
-          const foreign = foreignImports(bytes);
-          const compiled = await WebAssembly.compile(bytes);
-          return {
-            module: compiled,
-            ...memory ? { memory } : {},
-            foreign
-          };
-        });
-        this.compiled.set(key, module);
-        module.catch(() => this.compiled.delete(key));
-      }
-      return module;
+  verifiedFs(fs) {
+    const read = (path) => this.verified(path, KERNEL_CALLER, fs);
+    return Object.assign(Object.create(fs), {
+      readFileBuffer: read,
+      readFile: (path) => this.integrity ? this.text(path, KERNEL_CALLER) : fs.readFile(path)
+    });
+  }
+  async cacheKey(path) {
+    const verified = await this.integrity?.key(path);
+    if (verified !== void 0) return verified;
+    const st = await this.base.stat(path);
+    return `${path}:${st.size}:${st.mtime.getTime()}`;
+  }
+  verified(path, caller, fs = this.base) {
+    const plain = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain) : plain();
+  }
+  keyed(path, caller) {
+    const plain = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain) : plain().then((bytes) => ({ bytes }));
+  }
+  cached(cache, key, load) {
+    const hit = cache.get(key);
+    if (hit !== void 0) return hit;
+    const loading2 = load();
+    const found = loading2.then(({ value }) => value);
+    cache.set(key, found);
+    loading2.then(
+      (done4) => {
+        if (done4.key === key || done4.key === void 0 && !key.includes("\0")) return;
+        if (cache.get(key) === found) cache.delete(key);
+        if (done4.key !== void 0) cache.set(done4.key, found);
+      },
+      () => cache.delete(key)
+    );
+    return found;
+  }
+  async module(path, caller) {
+    const key = await this.cacheKey(path);
+    return this.cached(this.compiled, key, async () => {
+      const { bytes, key: read } = await this.keyed(path, caller);
+      const memory = importedMemory(bytes);
+      const foreign = foreignImports(bytes);
+      const compiled = await WebAssembly.compile(bytes);
+      return { value: { module: compiled, ...memory ? { memory } : {}, foreign }, key: read };
+    });
+  }
+  async checkedSources(planned, caller) {
+    const { target } = planned;
+    const files = [target.wasm, target.glue, target.imports, ...planned.sources ?? []];
+    const manifests = /* @__PURE__ */ new Set();
+    for (const file of files) {
+      const root = file === void 0 ? void 0 : PACKAGE_ROOT.exec(file)?.[1];
+      if (root !== void 0) manifests.add(`${root}/package.json`);
+    }
+    for (const source of planned.sources ?? []) await this.text(source, caller);
+    for (const manifest of manifests) {
+      if (await this.base.exists(manifest)) await this.text(manifest, caller);
+    }
+  }
+  async text(path, caller) {
+    if (!this.integrity) return this.base.readFile(path);
+    const key = await this.cacheKey(path);
+    return this.cached(this.texts, key, async () => {
+      const { bytes, key: read } = await this.keyed(path, caller);
+      return { value: new TextDecoder().decode(bytes), key: read };
     });
   }
   async names(path, module) {
@@ -16872,23 +17827,23 @@ var Launcher = class {
     const optional = `${root}-names${beside.slice(root.length)}`;
     return await this.base.exists(optional) ? optional : void 0;
   }
-  async program(target, env) {
+  async program(target, env, caller) {
     if (target.abi === "js" && target.wasm === SUDO_PATH) {
       return { abi: "js", glue: SUDO_SOURCE, path: SUDO_PATH };
     }
     if (target.abi === "js") {
-      return { abi: "js", glue: await this.base.readFile(target.wasm), path: target.wasm };
+      return { abi: "js", glue: await this.text(target.wasm, caller), path: target.wasm };
     }
     if (target.abi !== "wasi") {
       const [glue, { module: module2 }] = await Promise.all([
-        this.base.readFile(target.glue),
-        this.module(target.wasm)
+        this.text(target.glue, caller),
+        this.module(target.wasm, caller)
       ]);
       return { glue, module: module2 };
     }
-    const { module, memory, foreign } = await this.module(target.wasm);
+    const { module, memory, foreign } = await this.module(target.wasm, caller);
     const names = env.SLICC_WASM_BACKTRACE === "1" ? await this.names(target.wasm, module) : void 0;
-    const imports = target.imports ? await this.base.readFile(target.imports) : void 0;
+    const imports = target.imports ? await this.text(target.imports, caller) : void 0;
     return {
       abi: "wasi",
       glue: "",
@@ -16907,10 +17862,13 @@ var Launcher = class {
     const seen = { ...req.env, HOSTNAME: this.hostname, cwd };
     const env = { ...expandDefaults(target.env, seen), ...req.env };
     for (const key of target.unset ?? []) delete env[key];
+    delete env[TICKET_ENV];
     env.HOSTNAME = this.hostname;
     let program;
     try {
-      program = await this.program(target, env);
+      const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tag };
+      if (this.integrity) await this.checkedSources(planned, caller);
+      program = await this.program(target, env, caller);
     } catch (err) {
       await req.fds.closeAll();
       throw err;
@@ -16920,16 +17878,23 @@ var Launcher = class {
   groupSession(pgid) {
     return this.jobs.sessionOf(pgid);
   }
+  treeScrubs(pid, req) {
+    const inherited2 = req.ppid !== void 0 ? this.scrubs.get(req.ppid) : void 0;
+    const scrubs = req.scrub ? [...inherited2 ?? [], req.scrub] : inherited2;
+    if (scrubs) this.scrubs.set(pid, scrubs);
+    return scrubs;
+  }
   start(req) {
     this.sampling();
     if (req.pgid !== void 0 && this.jobs.sessionOf(req.pgid) === void 0) {
       throw new SpawnError("ESRCH");
     }
-    const pid = this.nextPid++;
+    const pid = req.pid ?? this.nextPid++;
+    const scrubs = this.treeScrubs(pid, req);
     const stack = this.stackFor(req.tag);
     const terminal = req.fds.stdioTerminal();
     const decided = req.decided ?? Promise.resolve(true);
-    const count = (byParent) => {
+    const count2 = (byParent) => {
       this.identities.asked++;
       if (!byParent) this.identities.timedOut++;
     };
@@ -16937,7 +17902,7 @@ var Launcher = class {
     const handle = spawnWasmProcess({
       pid,
       identity: async () => {
-        await (asked ??= decided.then(count));
+        await (asked ??= decided.then(count2));
         return this.identityOf(pid);
       },
       onSyscall: (call) => {
@@ -16951,6 +17916,7 @@ var Launcher = class {
       ...this.owners && req.program.abi === "wasi" ? { fresh: (path, umask) => this.freshModules.add(path, umask, pid) } : {},
       ...this.owners ? { owners: true } : {},
       sealed: this.sealed,
+      ...scrubs ? { ttyFilter: (file) => scrubbedAll(file, scrubs) } : {},
       clipboard: this.clipboard,
       ...this.dac ? { dac: this.dac } : {},
       program: req.program,
@@ -17017,6 +17983,7 @@ var Launcher = class {
       if (spent) addTimes(this.imageTimes, this.jobs.shown(pid), spent);
       this.stopped.delete(pid);
       this.processes.delete(pid);
+      this.scrubs.delete(pid);
       if (this.processes.size === 0) {
         clearInterval(this.sampler);
         this.sampler = void 0;
@@ -17188,6 +18155,7 @@ var Launcher = class {
   }
   spawner(ppid, report) {
     return async (req, fds, grant) => {
+      const booked = this.takeTicket(req);
       if (grant && !await this.grantedCwd(grant.caller, req.cwd)) {
         await fds.closeAll();
         throw new SpawnError("EACCES");
@@ -17199,23 +18167,20 @@ var Launcher = class {
       }
       const cred = grant ? grant.cred : this.credOf(ppid);
       const scope = grant ? "" : await this.scopeOf(cred.euid);
-      const planned = await this.plan(req.file, req.argv, req.cwd, scope, req.argv0);
-      try {
-        await this.mayExec(cred, { ...req, pid: ppid }, planned);
-      } catch (err) {
-        await fds.closeAll();
-        throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
-      }
-      if (!planned) {
-        await fds.closeAll();
-        throw new SpawnError(await this.unrunnable(req.file, req.cwd, scope));
-      }
+      const file = booked === void 0 ? req.file : await this.ticketFile(req, fds);
+      const planned = await this.checkedPlan({ ...req, file }, { ppid, cred, scope }, fds);
+      const redeemed = await this.redeemed(
+        { ...req, file },
+        { ppid, cred, scope, booked },
+        planned,
+        fds
+      );
       const exec = req.exec ? { exec: true } : {};
       const deciding = req.exec ? void 0 : this.undecided(ppid);
       const handle = await this.launch(planned, {
         ...deciding ? { decided: deciding.promise } : {},
-        env: req.env,
         cwd: req.cwd,
+        ...redeemed,
         fds,
         report,
         ppid,
@@ -17268,11 +18233,11 @@ var Launcher = class {
     if (!waiting) return;
     this.deciding.delete(ppid);
     setTimeout(() => {
-      for (const resolve of waiting) resolve(true);
+      for (const resolve2 of waiting) resolve2(true);
     }, 0);
   }
   forker(ppid, parent) {
-    const { exec: _exec, pgid: _pgid, group: _group, ...image } = parent;
+    const { exec: _exec, pgid: _pgid, group: _group, pid: _pid, scrub: _scrub, ...image } = parent;
     return async (state, fds) => childHandle(
       this.start({
         ...image,
@@ -17402,11 +18367,14 @@ var Launcher = class {
         }
       };
     }
-    const module = (await scanFilesystems(this.base, await this.roots())).get(type);
+    const module = (await scanFilesystems(this.scanned, await this.roots())).get(type);
     if (!module) throw fsError("ENODEV", `unknown file system type ${type}`);
     if (!this.createDriverWorker)
       throw fsError("ENODEV", `this kernel cannot start ${type} drivers`);
-    const code = await this.base.readFile(module);
+    const root = PACKAGE_ROOT.exec(module)?.[1];
+    if (this.integrity && root !== void 0)
+      await this.text(`${root}/package.json`, KERNEL_CALLER);
+    const code = new TextDecoder().decode(await this.verified(module, KERNEL_CALLER));
     const worker = this.createDriverWorker();
     const driver = new MessageChannel();
     const client = new MessageChannel();
@@ -17646,7 +18614,14 @@ var Launcher = class {
     );
   }
   environment(cwd, extra, account) {
-    return { ...this.env, ...userEnv(account, this.pnpmHome), PWD: cwd, ...extra };
+    const env = {
+      ...this.env,
+      ...userEnv(account, this.pnpmHome),
+      PWD: cwd,
+      ...extra
+    };
+    delete env[TICKET_ENV];
+    return env;
   }
   async account(user) {
     if (typeof user === "object") return user;
@@ -17742,7 +18717,7 @@ var Launcher = class {
       },
       account
     );
-    const report = (message3) => options.onData(encoder5.encode(`${message3}\r
+    const report = (message3) => options.onData(encoder7.encode(`${message3}\r
 `));
     const handle = await this.launch(planned, {
       env,
@@ -17773,18 +18748,18 @@ var Launcher = class {
     const env = this.environment(cwd, options.env, account);
     const out = [];
     const err = [];
-    const keep = options.collect !== false;
+    const keep2 = options.collect !== false;
     const collect = (chunks, tee) => (bytes) => {
-      if (keep) chunks.push(bytes);
+      if (keep2) chunks.push(bytes);
       tee?.(bytes);
     };
     const stdout = collect(out, options.onStdout);
     const stderr = collect(err, options.onStderr);
-    const report = (message3) => stderr(encoder5.encode(`${message3}
+    const report = (message3) => stderr(encoder7.encode(`${message3}
 `));
     if (!planned) {
       report(`${file}: command not found`);
-      return { status: NOT_FOUND, stdout: concat5(out), stderr: concat5(err) };
+      return { status: NOT_FOUND, stdout: concat6(out), stderr: concat6(err) };
     }
     const fds = new FdTable();
     fds.installAt(0, options.stdin ? bytesSource(options.stdin) : deviceFile("null"));
@@ -17802,7 +18777,7 @@ var Launcher = class {
     options.onStarted?.(handle.pid);
     const status = await handle.exited;
     const signal = handle.termsig();
-    return { status, ...signal ? { signal } : {}, stdout: concat5(out), stderr: concat5(err) };
+    return { status, ...signal ? { signal } : {}, stdout: concat6(out), stderr: concat6(err) };
   }
 };
 
@@ -17903,14 +18878,14 @@ function dial(l, req) {
 function sudoApprovals(port) {
   const waiting = /* @__PURE__ */ new Map();
   return {
-    ask: (req, { signal }) => new Promise((resolve) => {
-      waiting.set(req.id, resolve);
+    ask: (req, { signal }) => new Promise((resolve2) => {
+      waiting.set(req.id, resolve2);
       signal.addEventListener(
         "abort",
         () => {
           waiting.delete(req.id);
           port.postMessage({ sudoAbort: { id: req.id, reason: String(signal.reason) } });
-          resolve("deny");
+          resolve2("deny");
         },
         { once: true }
       );
@@ -17977,22 +18952,26 @@ function usersOp(l, req) {
   if (req.op === "groups-remove-member") return l.users.removeMember(req.group, req.user);
   return l.users.list();
 }
-function hostOptions(req, port, sealed, clipboard) {
+function hostOptions(req, port, sealed, clipboard, lookup) {
   return {
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
-    ...req.protect ? { protect: protectInit(req.protect) } : {},
+    ...req.protect ? { protect: hostProtect(req.protect, lookup) } : {},
     ...req.sealed ? { sealed } : {},
     ...req.clipboard ? { clipboard } : {}
   };
 }
+function hostProtect(init, lookup) {
+  const { integrity, ...rest2 } = protectInit(init);
+  return { ...rest2, ...integrity ? { integrity: { ...integrity, lookup } } : {} };
+}
 function policyAsker(port) {
   const policies = /* @__PURE__ */ new Map();
   let nextPolicy = 0;
-  const askPolicy = (req) => new Promise((resolve) => {
+  const askPolicy = (req) => new Promise((resolve2) => {
     const id2 = ++nextPolicy;
-    policies.set(id2, resolve);
+    policies.set(id2, resolve2);
     port.postMessage({ mountPolicy: { id: id2, req } });
   });
   return {
@@ -18015,14 +18994,15 @@ function serveKernel(port, deps) {
   const clients = /* @__PURE__ */ new Set();
   const sealed = sealedAsker(port);
   const clipboard = clipboardAsker(port);
+  const integrity = integrityAsker(port);
   const approvals = sudoApprovals(port);
   const locks = deps.locks === null ? void 0 : deps.locks ?? locksOf();
   let holding;
   function holdLock(locks2) {
-    holding ??= new Promise((resolve) => {
+    holding ??= new Promise((resolve2) => {
       const name2 = `slicc-kernel:${crypto.randomUUID()}`;
       void locks2.request(name2, () => {
-        resolve(name2);
+        resolve2(name2);
         return new Promise(() => {
         });
       });
@@ -18081,7 +19061,7 @@ function serveKernel(port, deps) {
         ...deps.createDriverWorker ? { createDriverWorker: deps.createDriverWorker } : {},
         ...req.modules ? { modules: req.modules } : {},
         ...req.env ? { env: req.env } : {},
-        ...hostOptions(req, port, sealed.hook, clipboard.hook),
+        ...hostOptions(req, port, sealed.hook, clipboard.hook, integrity.lookup),
         ...req.approve ? { approve: approvals.ask } : {},
         ...net,
         ...media ? { media } : {},
@@ -18151,6 +19131,8 @@ function serveKernel(port, deps) {
     if (sealedReply) return sealed.answer(sealedReply);
     const clipboardReply = event.data.clipboardReply;
     if (clipboardReply) return clipboard.answer(clipboardReply);
+    const integrityReply = event.data.integrityReply;
+    if (integrityReply) return integrity.answer(integrityReply);
     const grant = event.data.hostfsGrant;
     if (grant) return granted2(grant);
     if (allowed(event.data)) return;